1 /* SPDX-License-Identifier: GPL-2.0 */
3 * Kernel Electric-Fence (KFENCE). For more info please see
4 * Documentation/dev-tools/kfence.rst.
6 * Copyright (C) 2020, Google LLC.
9 #ifndef MM_KFENCE_KFENCE_H
10 #define MM_KFENCE_KFENCE_H
13 #include <linux/slab.h>
14 #include <linux/spinlock.h>
15 #include <linux/types.h>
17 #include "../slab.h" /* for struct kmem_cache */
20 * Get the canary byte pattern for @addr. Use a pattern that varies based on the
21 * lower 3 bits of the address, to detect memory corruptions with higher
22 * probability, where similar constants are used.
24 #define KFENCE_CANARY_PATTERN(addr) ((u8)0xaa ^ (u8)((unsigned long)(addr) & 0x7))
26 /* Maximum stack depth for reports. */
27 #define KFENCE_STACK_DEPTH 64
29 /* KFENCE object states. */
30 enum kfence_object_state {
31 KFENCE_OBJECT_UNUSED, /* Object is unused. */
32 KFENCE_OBJECT_ALLOCATED, /* Object is currently allocated. */
33 KFENCE_OBJECT_FREED, /* Object was allocated, and then freed. */
36 /* Alloc/free tracking information. */
41 int num_stack_entries;
42 unsigned long stack_entries[KFENCE_STACK_DEPTH];
45 /* KFENCE metadata per guarded allocation. */
46 struct kfence_metadata {
47 struct list_head list; /* Freelist node; access under kfence_freelist_lock. */
48 struct rcu_head rcu_head; /* For delayed freeing. */
51 * Lock protecting below data; to ensure consistency of the below data,
52 * since the following may execute concurrently: __kfence_alloc(),
53 * __kfence_free(), kfence_handle_page_fault(). However, note that we
54 * cannot grab the same metadata off the freelist twice, and multiple
55 * __kfence_alloc() cannot run concurrently on the same metadata.
59 /* The current state of the object; see above. */
60 enum kfence_object_state state;
63 * Allocated object address; cannot be calculated from size, because of
64 * alignment requirements.
66 * Invariant: ALIGN_DOWN(addr, PAGE_SIZE) is constant.
71 * The size of the original allocation.
76 * The kmem_cache cache of the last allocation; NULL if never allocated
77 * or the cache has already been destroyed.
79 struct kmem_cache *cache;
82 * In case of an invalid access, the page that was unprotected; we
83 * optimistically only store one address.
85 unsigned long unprotected_page;
87 /* Allocation and free stack information. */
88 struct kfence_track alloc_track;
89 struct kfence_track free_track;
92 extern struct kfence_metadata kfence_metadata[CONFIG_KFENCE_NUM_OBJECTS];
94 /* KFENCE error types for report generation. */
95 enum kfence_error_type {
96 KFENCE_ERROR_OOB, /* Detected a out-of-bounds access. */
97 KFENCE_ERROR_UAF, /* Detected a use-after-free access. */
98 KFENCE_ERROR_CORRUPTION, /* Detected a memory corruption on free. */
99 KFENCE_ERROR_INVALID, /* Invalid access of unknown type. */
100 KFENCE_ERROR_INVALID_FREE, /* Invalid free. */
103 void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *regs,
104 const struct kfence_metadata *meta, enum kfence_error_type type);
106 void kfence_print_object(struct seq_file *seq, const struct kfence_metadata *meta);
108 #endif /* MM_KFENCE_KFENCE_H */